1 /* 2 * Copyright (c) 1989, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * @(#)kern_ktrace.c 8.2 (Berkeley) 9/23/93 34 * $FreeBSD$ 35 */ 36 37 #include "opt_ktrace.h" 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/sysproto.h> 42 #include <sys/kernel.h> 43 #include <sys/proc.h> 44 #include <sys/fcntl.h> 45 #include <sys/lock.h> 46 #include <sys/namei.h> 47 #include <sys/vnode.h> 48 #include <sys/ktrace.h> 49 #include <sys/malloc.h> 50 #include <sys/syslog.h> 51 52 #include <vm/vm_zone.h> 53 54 #include <stddef.h> 55 56 static MALLOC_DEFINE(M_KTRACE, "KTRACE", "KTRACE"); 57 58 #ifdef KTRACE 59 static struct ktr_header *ktrgetheader __P((int type)); 60 static void ktrwrite __P((struct vnode *, struct ktr_header *)); 61 static int ktrcanset __P((struct proc *,struct proc *)); 62 static int ktrsetchildren __P((struct proc *,struct proc *,int,int,struct vnode *)); 63 static int ktrops __P((struct proc *,struct proc *,int,int,struct vnode *)); 64 65 66 static struct ktr_header * 67 ktrgetheader(type) 68 int type; 69 { 70 register struct ktr_header *kth; 71 struct proc *p = curproc; /* XXX */ 72 73 MALLOC(kth, struct ktr_header *, sizeof (struct ktr_header), 74 M_KTRACE, M_WAITOK); 75 kth->ktr_type = type; 76 microtime(&kth->ktr_time); 77 kth->ktr_pid = p->p_pid; 78 bcopy(p->p_comm, kth->ktr_comm, MAXCOMLEN + 1); 79 return (kth); 80 } 81 82 void 83 ktrsyscall(vp, code, narg, args) 84 struct vnode *vp; 85 int code, narg; 86 register_t args[]; 87 { 88 struct ktr_header *kth; 89 struct ktr_syscall *ktp; 90 register int len = offsetof(struct ktr_syscall, ktr_args) + 91 (narg * sizeof(register_t)); 92 struct proc *p = curproc; /* XXX */ 93 register_t *argp; 94 int i; 95 96 p->p_traceflag |= KTRFAC_ACTIVE; 97 kth = ktrgetheader(KTR_SYSCALL); 98 MALLOC(ktp, struct ktr_syscall *, len, M_KTRACE, M_WAITOK); 99 ktp->ktr_code = code; 100 ktp->ktr_narg = narg; 101 argp = &ktp->ktr_args[0]; 102 for (i = 0; i < narg; i++) 103 *argp++ = args[i]; 104 kth->ktr_buf = (caddr_t)ktp; 105 kth->ktr_len = len; 106 ktrwrite(vp, kth); 107 FREE(ktp, M_KTRACE); 108 FREE(kth, M_KTRACE); 109 p->p_traceflag &= ~KTRFAC_ACTIVE; 110 } 111 112 void 113 ktrsysret(vp, code, error, retval) 114 struct vnode *vp; 115 int code, error; 116 register_t retval; 117 { 118 struct ktr_header *kth; 119 struct ktr_sysret ktp; 120 struct proc *p = curproc; /* XXX */ 121 122 p->p_traceflag |= KTRFAC_ACTIVE; 123 kth = ktrgetheader(KTR_SYSRET); 124 ktp.ktr_code = code; 125 ktp.ktr_error = error; 126 ktp.ktr_retval = retval; /* what about val2 ? */ 127 128 kth->ktr_buf = (caddr_t)&ktp; 129 kth->ktr_len = sizeof(struct ktr_sysret); 130 131 ktrwrite(vp, kth); 132 FREE(kth, M_KTRACE); 133 p->p_traceflag &= ~KTRFAC_ACTIVE; 134 } 135 136 void 137 ktrnamei(vp, path) 138 struct vnode *vp; 139 char *path; 140 { 141 struct ktr_header *kth; 142 struct proc *p = curproc; /* XXX */ 143 144 p->p_traceflag |= KTRFAC_ACTIVE; 145 kth = ktrgetheader(KTR_NAMEI); 146 kth->ktr_len = strlen(path); 147 kth->ktr_buf = path; 148 149 ktrwrite(vp, kth); 150 FREE(kth, M_KTRACE); 151 p->p_traceflag &= ~KTRFAC_ACTIVE; 152 } 153 154 void 155 ktrgenio(vp, fd, rw, iov, len, error) 156 struct vnode *vp; 157 int fd; 158 enum uio_rw rw; 159 register struct iovec *iov; 160 int len, error; 161 { 162 struct ktr_header *kth; 163 register struct ktr_genio *ktp; 164 register caddr_t cp; 165 register int resid = len, cnt; 166 struct proc *p = curproc; /* XXX */ 167 168 if (error) 169 return; 170 p->p_traceflag |= KTRFAC_ACTIVE; 171 kth = ktrgetheader(KTR_GENIO); 172 MALLOC(ktp, struct ktr_genio *, sizeof(struct ktr_genio) + len, 173 M_KTRACE, M_WAITOK); 174 ktp->ktr_fd = fd; 175 ktp->ktr_rw = rw; 176 cp = (caddr_t)((char *)ktp + sizeof (struct ktr_genio)); 177 while (resid > 0) { 178 if ((cnt = iov->iov_len) > resid) 179 cnt = resid; 180 if (copyin(iov->iov_base, cp, (unsigned)cnt)) 181 goto done; 182 cp += cnt; 183 resid -= cnt; 184 iov++; 185 } 186 kth->ktr_buf = (caddr_t)ktp; 187 kth->ktr_len = sizeof (struct ktr_genio) + len; 188 189 ktrwrite(vp, kth); 190 done: 191 FREE(kth, M_KTRACE); 192 FREE(ktp, M_KTRACE); 193 p->p_traceflag &= ~KTRFAC_ACTIVE; 194 } 195 196 void 197 ktrpsig(vp, sig, action, mask, code) 198 struct vnode *vp; 199 int sig; 200 sig_t action; 201 sigset_t *mask; 202 int code; 203 { 204 struct ktr_header *kth; 205 struct ktr_psig kp; 206 struct proc *p = curproc; /* XXX */ 207 208 p->p_traceflag |= KTRFAC_ACTIVE; 209 kth = ktrgetheader(KTR_PSIG); 210 kp.signo = (char)sig; 211 kp.action = action; 212 kp.mask = *mask; 213 kp.code = code; 214 kth->ktr_buf = (caddr_t)&kp; 215 kth->ktr_len = sizeof (struct ktr_psig); 216 217 ktrwrite(vp, kth); 218 FREE(kth, M_KTRACE); 219 p->p_traceflag &= ~KTRFAC_ACTIVE; 220 } 221 222 void 223 ktrcsw(vp, out, user) 224 struct vnode *vp; 225 int out, user; 226 { 227 struct ktr_header *kth; 228 struct ktr_csw kc; 229 struct proc *p = curproc; /* XXX */ 230 231 p->p_traceflag |= KTRFAC_ACTIVE; 232 kth = ktrgetheader(KTR_CSW); 233 kc.out = out; 234 kc.user = user; 235 kth->ktr_buf = (caddr_t)&kc; 236 kth->ktr_len = sizeof (struct ktr_csw); 237 238 ktrwrite(vp, kth); 239 FREE(kth, M_KTRACE); 240 p->p_traceflag &= ~KTRFAC_ACTIVE; 241 } 242 #endif 243 244 /* Interface and common routines */ 245 246 /* 247 * ktrace system call 248 */ 249 #ifndef _SYS_SYSPROTO_H_ 250 struct ktrace_args { 251 char *fname; 252 int ops; 253 int facs; 254 int pid; 255 }; 256 #endif 257 /* ARGSUSED */ 258 int 259 ktrace(curp, uap) 260 struct proc *curp; 261 register struct ktrace_args *uap; 262 { 263 #ifdef KTRACE 264 register struct vnode *vp = NULL; 265 register struct proc *p; 266 struct pgrp *pg; 267 int facs = uap->facs & ~KTRFAC_ROOT; 268 int ops = KTROP(uap->ops); 269 int descend = uap->ops & KTRFLAG_DESCEND; 270 int ret = 0; 271 int error = 0; 272 struct nameidata nd; 273 274 curp->p_traceflag |= KTRFAC_ACTIVE; 275 if (ops != KTROP_CLEAR) { 276 /* 277 * an operation which requires a file argument. 278 */ 279 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->fname, curp); 280 error = vn_open(&nd, FREAD|FWRITE|O_NOFOLLOW, 0); 281 if (error) { 282 curp->p_traceflag &= ~KTRFAC_ACTIVE; 283 return (error); 284 } 285 NDFREE(&nd, NDF_ONLY_PNBUF); 286 vp = nd.ni_vp; 287 VOP_UNLOCK(vp, 0, curp); 288 if (vp->v_type != VREG) { 289 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 290 curp->p_traceflag &= ~KTRFAC_ACTIVE; 291 return (EACCES); 292 } 293 } 294 /* 295 * Clear all uses of the tracefile 296 */ 297 if (ops == KTROP_CLEARFILE) { 298 LIST_FOREACH(p, &allproc, p_list) { 299 if (p->p_tracep == vp) { 300 if (ktrcanset(curp, p)) { 301 p->p_tracep = NULL; 302 p->p_traceflag = 0; 303 (void) vn_close(vp, FREAD|FWRITE, 304 p->p_ucred, p); 305 } else 306 error = EPERM; 307 } 308 } 309 goto done; 310 } 311 /* 312 * need something to (un)trace (XXX - why is this here?) 313 */ 314 if (!facs) { 315 error = EINVAL; 316 goto done; 317 } 318 /* 319 * do it 320 */ 321 if (uap->pid < 0) { 322 /* 323 * by process group 324 */ 325 pg = pgfind(-uap->pid); 326 if (pg == NULL) { 327 error = ESRCH; 328 goto done; 329 } 330 LIST_FOREACH(p, &pg->pg_members, p_pglist) 331 if (descend) 332 ret |= ktrsetchildren(curp, p, ops, facs, vp); 333 else 334 ret |= ktrops(curp, p, ops, facs, vp); 335 336 } else { 337 /* 338 * by pid 339 */ 340 p = pfind(uap->pid); 341 if (p == NULL) { 342 error = ESRCH; 343 goto done; 344 } 345 if (descend) 346 ret |= ktrsetchildren(curp, p, ops, facs, vp); 347 else 348 ret |= ktrops(curp, p, ops, facs, vp); 349 } 350 if (!ret) 351 error = EPERM; 352 done: 353 if (vp != NULL) 354 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 355 curp->p_traceflag &= ~KTRFAC_ACTIVE; 356 return (error); 357 #else 358 return ENOSYS; 359 #endif 360 } 361 362 /* 363 * utrace system call 364 */ 365 /* ARGSUSED */ 366 int 367 utrace(curp, uap) 368 struct proc *curp; 369 register struct utrace_args *uap; 370 { 371 #ifdef KTRACE 372 struct ktr_header *kth; 373 struct proc *p = curproc; /* XXX */ 374 register caddr_t cp; 375 376 if (!KTRPOINT(p, KTR_USER)) 377 return (0); 378 p->p_traceflag |= KTRFAC_ACTIVE; 379 kth = ktrgetheader(KTR_USER); 380 MALLOC(cp, caddr_t, uap->len, M_KTRACE, M_WAITOK); 381 if (!copyin(uap->addr, cp, uap->len)) { 382 kth->ktr_buf = cp; 383 kth->ktr_len = uap->len; 384 ktrwrite(p->p_tracep, kth); 385 } 386 FREE(kth, M_KTRACE); 387 FREE(cp, M_KTRACE); 388 p->p_traceflag &= ~KTRFAC_ACTIVE; 389 390 return (0); 391 #else 392 return (ENOSYS); 393 #endif 394 } 395 396 #ifdef KTRACE 397 static int 398 ktrops(curp, p, ops, facs, vp) 399 struct proc *p, *curp; 400 int ops, facs; 401 struct vnode *vp; 402 { 403 404 if (!ktrcanset(curp, p)) 405 return (0); 406 if (ops == KTROP_SET) { 407 if (p->p_tracep != vp) { 408 /* 409 * if trace file already in use, relinquish 410 */ 411 if (p->p_tracep != NULL) 412 vrele(p->p_tracep); 413 VREF(vp); 414 p->p_tracep = vp; 415 } 416 p->p_traceflag |= facs; 417 if (curp->p_ucred->cr_uid == 0) 418 p->p_traceflag |= KTRFAC_ROOT; 419 } else { 420 /* KTROP_CLEAR */ 421 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 422 /* no more tracing */ 423 p->p_traceflag = 0; 424 if (p->p_tracep != NULL) { 425 vrele(p->p_tracep); 426 p->p_tracep = NULL; 427 } 428 } 429 } 430 431 return (1); 432 } 433 434 static int 435 ktrsetchildren(curp, top, ops, facs, vp) 436 struct proc *curp, *top; 437 int ops, facs; 438 struct vnode *vp; 439 { 440 register struct proc *p; 441 register int ret = 0; 442 443 p = top; 444 for (;;) { 445 ret |= ktrops(curp, p, ops, facs, vp); 446 /* 447 * If this process has children, descend to them next, 448 * otherwise do any siblings, and if done with this level, 449 * follow back up the tree (but not past top). 450 */ 451 if (!LIST_EMPTY(&p->p_children)) 452 p = LIST_FIRST(&p->p_children); 453 else for (;;) { 454 if (p == top) 455 return (ret); 456 if (LIST_NEXT(p, p_sibling)) { 457 p = LIST_NEXT(p, p_sibling); 458 break; 459 } 460 p = p->p_pptr; 461 } 462 } 463 /*NOTREACHED*/ 464 } 465 466 static void 467 ktrwrite(vp, kth) 468 struct vnode *vp; 469 register struct ktr_header *kth; 470 { 471 struct uio auio; 472 struct iovec aiov[2]; 473 register struct proc *p = curproc; /* XXX */ 474 int error; 475 476 if (vp == NULL) 477 return; 478 auio.uio_iov = &aiov[0]; 479 auio.uio_offset = 0; 480 auio.uio_segflg = UIO_SYSSPACE; 481 auio.uio_rw = UIO_WRITE; 482 aiov[0].iov_base = (caddr_t)kth; 483 aiov[0].iov_len = sizeof(struct ktr_header); 484 auio.uio_resid = sizeof(struct ktr_header); 485 auio.uio_iovcnt = 1; 486 auio.uio_procp = curproc; 487 if (kth->ktr_len > 0) { 488 auio.uio_iovcnt++; 489 aiov[1].iov_base = kth->ktr_buf; 490 aiov[1].iov_len = kth->ktr_len; 491 auio.uio_resid += kth->ktr_len; 492 } 493 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); 494 error = VOP_WRITE(vp, &auio, IO_UNIT|IO_APPEND, p->p_ucred); 495 VOP_UNLOCK(vp, 0, p); 496 if (!error) 497 return; 498 /* 499 * If error encountered, give up tracing on this vnode. 500 */ 501 log(LOG_NOTICE, "ktrace write failed, errno %d, tracing stopped\n", 502 error); 503 LIST_FOREACH(p, &allproc, p_list) { 504 if (p->p_tracep == vp) { 505 p->p_tracep = NULL; 506 p->p_traceflag = 0; 507 vrele(vp); 508 } 509 } 510 } 511 512 /* 513 * Return true if caller has permission to set the ktracing state 514 * of target. Essentially, the target can't possess any 515 * more permissions than the caller. KTRFAC_ROOT signifies that 516 * root previously set the tracing status on the target process, and 517 * so, only root may further change it. 518 * 519 * TODO: check groups. use caller effective gid. 520 */ 521 static int 522 ktrcanset(callp, targetp) 523 struct proc *callp, *targetp; 524 { 525 register struct pcred *caller = callp->p_cred; 526 register struct pcred *target = targetp->p_cred; 527 528 if (!PRISON_CHECK(callp, targetp)) 529 return (0); 530 if ((caller->pc_ucred->cr_uid == target->p_ruid && 531 target->p_ruid == target->p_svuid && 532 caller->p_rgid == target->p_rgid && /* XXX */ 533 target->p_rgid == target->p_svgid && 534 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 535 caller->pc_ucred->cr_uid == 0) 536 return (1); 537 538 return (0); 539 } 540 541 #endif /* KTRACE */ 542